Decode a demo token
Input The prefilled token, exp = 1700003600.
Result Algorithm HS256, type JWT, four claims, expiry 2023-11-14 23:13:20 UTC.
Paste a JSON Web Token to read its header, payload and exact expiry time — decoded locally, so the token never leaves your browser.
Result
Change any input and the result updates instantly.
Input The prefilled token, exp = 1700003600.
Result Algorithm HS256, type JWT, four claims, expiry 2023-11-14 23:13:20 UTC.
Input A payload of {"sub":"42","scope":"read"}.
Result The status reads that the token has no expiry claim, so it never lapses on its own.
Input abc.def
Result An error explains that a JWT must have three parts before anything can be decoded.
No. Anyone can craft a token with any payload they like. Only a server that verifies the signature with the secret or public key can tell whether a token was issued by you.
Decoding happens in your browser, so the token is not uploaded. Treat it like a password anyway: prefer a test token, and rotate anything you paste into a shared screen.
Either the issuer clock is behind yours, or an exp value in milliseconds was passed where seconds are expected. This tool reads exp as seconds, matching the JWT specification.
The decoder reports an error. The JWT specification requires both parts to be base64url-encoded JSON objects, so a non-JSON part usually means the string is not a JWT at all.
Disclaimer: Results follow the formula shown on this page and are for reference only. Real-world quantities vary with materials, technique and conditions, so allow a margin before ordering.